Analysis

The crypto subsystem is the kernel’s trust foundation. Copy Fail weaponizes it with a 732-byte deterministic exploit that corrupts privileged binaries in memory without touching the disk – EPSS 0.99907, near-certain exploitation probability.

The Deterministic Failure of Kernel Cryptography

CVE-2026-31431, known as Copy Fail, represents a significant departure from the typical, often unstable, landscape of local privilege escalation (LPE) exploits. Published on April 22, 2026, and subsequently added to the CISA Known Exploited Vulnerabilities catalog on May 1, 2026, this vulnerability targets the Linux kernel’s cryptographic subsystem. Specifically, it resides within the algif_aead module of the AF_ALG userspace crypto…